onionroutingfandomcom-20200213-history
Onions
__TOC__The term ‘Onion’ is used to describe the basic data structure of a message sent through an onion network and consists of a packet wrapped in successive layers of encryption. The onion is encapsulated in this way at the onion proxy, where it is then forwarded to the entry funnel. Upon exit from the onion network at the exit funnel, the packet is identical to the one that was sent to the onion proxy. From this stage it continues on to its final destination. For more information on this topic please consult the routing of an onion page. 'Onion Structure' The ‘Onion’ structure exists only at the application level, at lower levels the onion runs over TCP for guaranteed delivery of data and IP for traversal of the internet. When a node obtains the next hop information from the application level onion payload, it is then entered into the destination field in the IP layer header of the packet to be sent to the next node. At this stage the IP information for the source host is also modify to reflect the current node. Constantly changing the source and destination IP addresses is what makes tracing a packet impossible and is what gives onion routing its online anonymity functionality. To anyone observing the network it appears as though the originator of the packet is the node and it is being sent to the next node, there is no indication of its true original and final destinations. Doing this makes it impossible to track any single packet through the entire network, as a message would appear to be multiple different messages as it traverses a network. below: structure of an onion as it traverses the network 'Security' As mentioned previously, the defining feature of an onion is its multiple layers of public key encryption that protect the data, its origin, and its destination. The onion is encoded with the public key of each of the routers it will traverse on its journey to the destination host. Each node that it passes through will decode the first or ‘outermost’ public key, which can be thought of as peeling the outermost layer of an onion. Removing this reveals the next host to be sent to, data which is used to create the IP header of the packet it sends out to the next host in the process. The only exception to this rule is at the exit funnel of the onion network. At this stage the last layer of encryption is removed, revealing the original message. The source IP of this output packet is set to the exit funnel and then sent on its way as any other packet would be to its end destination. It is worth noting that onion routing does not provide end to end encryption of data, and thus is not suitable for transmitting sensitive data without using some other encryption schema. An attacker can intercept a targets message before it reaches the onion network just as with any other message transmitted across a network, as before it reaches the onion proxy the message is no different from any other message being sent across the network and it is not yet in the onion format. This is also true if an attacker obtains the data after it has left the exit node. However, even if data is sniffed at either of these points anonymity of communication will prevail, as the destination IP will be that of the onion proxy, or the source IP will be that of the exit funnel, depending on the location in transit that the message is attacked. When using this technology any node in the chain only knows the source node and next hop node, not anywhere near enough to be of use to anyone trying to monitor traffic. This is true even if all of the nodes in the chain are compromised (extremely unlikely) as it is extremely difficult to trace the path of an onion from node to node due to the source and destination IP addresses change with every hop. 'Return Onions' Anonymous communication would prove rather useless if the end host that was being communicated with sent the messages directly back to the source, as the direct communication could positively link the two together. Furthermore anonymity would be further compromised because the IP information of the source host would have to be included in the information sent to the destination, completely negating the purpose of onion routing. To get around this shortcoming something known as a return onion is implemented. When the original onion is created at the onion proxy a second identical onion is also created. This onions application data is a third onion, with this third onion being the actual return onion. It is exactly the same as the other two created except the routing data and public keys have been reversed, with the ‘outermost’ keys becoming the ‘innermost’ and vice versa. This return onion then sits at the exit funnel and waits for a return message from the destination host, as the source IP of the packet sent to the destination host is that of the exit funnel, so any return information would be sent there. Once a message is received from the destination host it is bundled into the return onion and sent back across the onion network to the source host, allowing for two way anonymous communication.